Re: Default installs vulnerable?

[John Summerfied <debian herakles homelinux org>]

Ed Greshko wrote:

> Anyway, I've been going to the sites, like the one above, and checking
> to see what is installed.  Many times, a simple entry of
> http://210.204.207.123/ proudly reveals the default Apache page and the
> "Powered by Red Hat" logo.
>
> The site above seems to be running an older version...but I've seen more
> recent default Apache pages.

Here's the sig from RHL 7.3 with all official updates in place:

HTTP/1.1 200 OK
Date: Wed, 20 Jul 2005 04:53:35 GMT
Server: Apache/1.3.27 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.12 
OpenSSL/0.9.6b DAV
/1.0.3 PHP/4.1.2 mod_perl/1.26
Last-Modified: Wed, 23 Oct 2002 18:53:13 GMT
ETag: "f389f-b4a-3db6f019"
Accept-Ranges: bytes
Content-Length: 2890
Connection: close
Content-Type: text/html

This is quite a bit newer than your site:
[summer bilby ~]$ lynx -head -dump http://210.204.207.123/
HTTP/1.1 200 OK
Date: Wed, 08 Dec 2004 15:29:39 GMT
Server: Apache/1.3.19 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.1 
OpenSSL/0.9.6 DAV/1
.0.2 PHP/4.0.4pl1 mod_perl/1.24_01
Last-Modified: Thu, 29 Mar 2001 17:53:01 GMT
ETag: "d7a41-b4a-3ac3767d"
Accept-Ranges: bytes
Content-Length: 2890
Connection: close
Content-Type: text/html


[summer bilby ~]$


Note its clock hasn't been set for a while either.

I believe RHL 6.2 was vulnerable by default.

--

Cheers
John

-- spambait
1aaaaaaa computerdatasafe com au  Z1aaaaaaa computerdatasafe com au
Tourist pics http://portgeographe.environmentaldisasters.cds.merseine.nu/